To cripple Windows 7

[robjduk]

Morning,

I have a member of staff with a Windows 7 x64 laptop who is due to leave in a weeks time. Now it looks like they are not best pleased at going and has started playing the "my contract runs to the end of August so I am keeping my laptop until then" but its the norm to return it at the end of term and they have got my back up with their attitude and as your all aware, network managers are silly people to upset so my question is this...

 

How do I cause her laptop to fail while making it look like an accident?

 

I used to be great at this in XP. The odd file removed from system32 would cause all sorts of havoc upon reboot but wonder if any of you know what to tweak to cause a failure to reboot while only removing files remotely on Windows 7? I could disable the account but that's going to be blindingly obvious. A nice black screen upon reboot will do the trick nicely.

When they ask for a repair they can have a nice loan machine of my choosing while I work hard to "fix their laptop" although I have a feeling its going to take more than a week to fix.

 

Thanks all

[FN-GM]

Delete the windows folder. It will fail but will delete key files so it wont be able to be repaired.

 

You should get your SLT to recall the laptop. It wasn't issued to them until the end of contract in the first place.

[robjduk]

Im doing this off my own back because I fear if I go to the higher ups they may say let them keep it for a quiet life. I will start work on the Windows folder shortly (little per day) but if anyone knows the golden file to delete then please shout.

[TechMonkey]

If you can remotely connect to their registry, randomly start deleting keys should do it. If you are selective about what you delete you can make it start to glitch but not be unusable and then just stop.

[Theblacksheep]

Why worry about it looking like an accident?

 

Disable the computer and user account on the last day. Computer and user accounts get disabled at the last day because they are no longer timetabled for teaching and the laptops are for teaching purposes. Its the schools laptop and is not part of a contractual commitment on behalf of the school.

[chazzy2501]

get the AV to do a scan and schedule disk defrags!

[robjduk]

im hoping to break it mid next week but may set the AV from stun to kill to build it up. Problem with doing it on last day is they just take it anyway. I would be happy they wouldn't be able to use it but they would still have it.

[Gatt]

Whilst its still on the network, get as scheduled task to remove the KMS/MAK key - not re-arm it - it will then lock her out until she gets a valid MAK / KMS key

 

Another would be to schedule the drive to run BitLocker and encrypt the C: Drive

[X-13]

Couldn't you force the screen resolution higher than it's allowed?

 

[Theoretical shenanigans]

 

You're looking for "Display1_DownScalingSupported" in the registry. [Can't remember the exact key] Set it to 1 [<- Possibly not this. It's too early to BOFH properly.]

 

Then set the resolution really high. ["HKLM\System\Currentcontrolset\Control\Video"]

 

And tweak the refresh rate while you're at it.

 

 

Hopefully, the laptop will either show a partial desktop [because it's stretched past the limits of the screen] or just display "Out of range".

 

 

Don't forget to disable changing the resolution for regular users.

 

 

Le EDIT: Mess about with "DefaultSettings.XPanning" and "DefaultSettings.YPanning" [under "HKLM\System\Currentcontrolset\Control\Video" with the resolution.]

Edited July 11, 2013 by X-13

[Gatt]

Change power options so that it sleeps every few seconds on battery or on power and when CPU is at a 'normal' level

Reghack the "Run" key so that when anyone logs in it instantly logs them off

 

easy enough to screw up the BCD - just edit it to point the boot location to, say, the floppy disk

Edited July 11, 2013 by Gatt

[X-13]

Change power options so that it sleeps every few seconds on battery or on power and when CPU is at a 'normal' level

 

Set a startup script to reboot.

[tmcd35]

The single best method on any version of Windows is to rename any of the files in this folder:

 

C:\Windows\System32\config

 

You should be able to do that remotely. Favourites are the SECURITY, SOFTWARE or SYSTEM files. Stops Windows loading the registry on boot and causes a nice black screen error message to appear. Give the teacher some waffle about "ooh, look like your hard drive is failing". Take laptop, rename file, all working again - thank you very much

[sted]

use group policy to deny local logon to members of the staff (or whatever group)

[Norphy]

I'm sorry, don't you see just how silly this thread is? You're talking about sabotaging someone's PC. On a publicly accessible, indexed, search engine crawled forum. I don't care how awkward this member of staff is being, you're leaving yourself open for trouble and frankly I'm amazed that anyone else is taking the time to help him. This is unprofessional and downright childish.

 

I would strongly suggest that you delete this thread before someone in your management sees it and you get yourself into trouble.

Edited July 11, 2013 by Norphy

[CAM]

You don't need to do any of this. If you suspect they are going to steal the laptop or do something to damage your data or infrastructure then you have every right to intervene. If the higher-ups want the easy life, make them aware that if a leaving member of staff walks off-site with a laptop containing personal and protected information, doesn't return it and proceeds to leak said data then there will be no easy life but a rather hefty fine. Even if they have no malicious intent, they still pose a risk as they may get complacent and think "Oh, I don't need to follow these guidelines anymore. What will they do, fire me? Nothing will happen."

 

You need to refer to the procedures and policies set in place for leavers and confidential data. You should already have some as part of data protection policies, if not you need to sort some out!

 

And before they argue, assessment and tracking spreadsheets are covered by the DPA.

[Gatt]

I can see where you are coming from @Norphy, but this can also be helpful if someone has deliberately not returned a laptop

 

Perhaps the OP is speaking hypothetically and isn't actually wanting to do what he or she is seeking advice on.

[X-13]

I can see where you are coming from @Norphy, but this can also be helpful if someone has deliberately not returned a laptop

 

Perhaps the OP is speaking hypothetically and isn't actually wanting to do what he or she is seeking advice on.

 

TBH, this is giving me ideas for when I need to get laptops back to do updates.

[witch]

I can see where you are coming from @Norphy, but this can also be helpful if someone has deliberately not returned a laptop

 

Perhaps the OP is speaking hypothetically and isn't actually wanting to do what he or she is seeking advice on.

 

I hope not too given that his or her name can possibly be guessed.

If the member of staff's contract does not finish at the end of term, and there is no official agreement to hand in a laptop ("the norm" doesn't really work) then that staff member is entitled to keep the laptop, surely?

[sted]

TBH, this is giving me ideas for when I need to get laptops back to do updates.

 

with that i just add add an annoying popup message to their startup folder so everytime they logon they get a notepad message saying IT needs your laptop asap or words to that effect

[CAM]

I hope not too given that his or her name can possibly be guessed.

If the member of staff's contract does not finish at the end of term, and there is no official agreement to hand in a laptop ("the norm" doesn't really work) then that staff member is entitled to keep the laptop, surely?

 

The laptop belongs to the school, they have no contractual obligation to even supply it in the first place. Therefore if the school wants it back, they can get it back. The staff member is just trying to use contracts to bamboozle management into blagging a free laptop.

[X-13]

"the norm" doesn't really work

 

That depends on what "the norm" means.

 

If it means "the usual rules are" then I'd disagree.

 

Changing the rules because a member of staff is whinging isn't fair on the rest.

[Gatt]

This is where KMS could have been really really useful

 

At present it only deactivcates after 90 days after it cannot find your KMS server

WOuld hva been nice to be able to force an immediate deactivation for a client - (KMS Server -> Microsoft -> Client sorta thing)

[Gatt]

Reading the OP - the user in question is stating (hypothetically!) that they intend to keep their laptop until the end of their contract

 

Now, the user may actually be entitled to keep said laptop - it all depends on the users contract as well as the employers IT policy - which usually says something along the lines of providing use of IT facilities (software, network resources, hardware) for the duration of their tenure with the company

 

If that is the case then unfortunately, said use is fully within their contracted rights to keep said laptop until they officially leave employment..

[sted]

This is where KMS could have been really really useful

 

At present it only deactivcates after 90 days after it cannot find your KMS server

WOuld hva been nice to be able to force an immediate deactivation for a client - (KMS Server -> Microsoft -> Client sorta thing)

 

iirc you can if you use vamt

[sparkeh]

This all comes down to what was agreed with the staff member and SMT. If they agreed that the laptop was usable by the teacher until the end of the contract then that's it really.

 

This is why our AUP states that staff laptops can be recalled at any point. All departing staff members have their laptops recalled before the end of term.

Edited July 11, 2013 by sparkeh